Office 365 Identity aka Azure Active Directory

1. Office 365 Identityaka Azure Active Directory Brian Arkills Software Engineer, UW Windows Infrastructure Svc Mgr, and Associate Troublemaking Officer  UW-IT, Identity and Access Management Microsoft Directory Services MVP 2012-2014

2. Goals • Azure Active Directory Architecture • Authentication Options • Provisioning Options • Examine Complex Implementation • Review Pitfalls

3. Azure Active Directory • AD revised to Internet-scale multi-tenant identity service • Extends AD into cloud; cloud –based identity • Connect from any platform, and device • Connect hundreds of SaaS apps or your on-premise apps SharePoint Online Cloud App Exchange Online Cloud App Lync Online Azure AD Your Custom IT App AD

4. AAD Architecture

5. Protocols to Connect with AAD

6. AAD Provisioning Options • AAD Graph API (RESTful web service) • Remote PowerShell • Multiple Directory Synchronization variants • DirSync: original appliance • FIM Sync: MS provides FIM connector, you provide business logic/code • AAD Sync: appliance re-engineered to encompass scenarios FIM Sync covered NOTE: the UPN and the object identifier are important. The UPN is a key parameter, the objID survives renames and is what federated authN keys on

7. AAD Authentication Options • Provision password in AAD • Federated authentication • More complex variations or mixes (e.g. UW) • Also there is MFA for Office 365 (powered by Azure MFA), no cost above existing O365 licenses NOTE: MOSSIA is needed for older Windows OSes when using a native Office client (fat client)

8. AuthNflow (Passive/Web profile) Customer Microsoft Online Services User Source ID Azure Active Directory Logon (SAML 1.1) Token UPN:user@contoso.com Source User ID: ABC123 Auth Token UPN:user@contoso.com Unique ID: 254729

9. AuthNflow (MEX/Rich Client Profile) Customer Microsoft Online Services User Source ID Azure Active Directory Logon (SAML 1.1) Token UPN:user@contoso.com Source User ID: ABC123 Auth Token UPN:user@contoso.com Unique ID: 254729

10. AuthN Active flow(Outlook/Active Sync) Customer Microsoft Online Services User Source ID Azure Active Directory Logon (SAML 1.1) Token UPN:user@contoso.com Source User ID: ABC123 Auth Token UPN:user@contoso.com Unique ID: 254729 Basic AuthCredentilas Username/Password

11. AuthN Regroup/Review • EO/SO/LO only trust logon tokens issued by AAD • In “bouncy slides” token issued b/c AAD trusts ADFS • AAD knew user@upn.com meant your ADFS server • Some clients/protocols can’t do federated authN, so service does them on behalf of client. Note: pwd sent over wire to service • Just as easily could not federate, with pwd in AAD (pwd would always go over wire then) • Multiple places to layer additional authN interactions (e.g. MFA or consent). Also multiple places to troubleshoot, if things go wrong

12. UW AuthN: ADFS + Shibboleth • Dueling Goals: • trusted, well-known web-based login experience of Shibboleth • Single sign-on experience for Windows domain joined clients via ADFS • So we did both! AAD trusts ADFS, ADFS trusts Shibboleth. • If client arrives at ADFS & has Windows token: done • If client doesn’t have Windows token -> Shibboleth

13. UW: Example AuthN flow UW Microsoft Online Services User Source ID Logon (SAML 1.1) Token UPN:user@uw.edu Source User ID: XYZ987 Logon (SAML 1.1) Token UPN:user@uw.edu Source User ID: ABC123 Auth Token UPN:user@contoso.com Unique ID: 254729

14. UVM AuthN Flow Diagram

15. Duplicate slide:AAD Provisioning Options • AAD Graph API (RESTful web service) • Remote PowerShell • Multiple Directory Synchronization variants • DirSync: original appliance • FIM Sync: MS provides FIM connector, you provide business logic/code • AAD Sync: appliance re-engineered to encompass scenarios FIM Sync covered NOTE: the UPN and the object identifier are important. The UPN is a key parameter, the objID survives renames and is what federated authN keys on

16. UW Provisioning: DirSync • FERPA prevents us from exposing directory data. AAD has no read controls today. • Need to filter out directory data that goes to AAD, until AAD has more capabilities • Considered FIM Sync, but overkill. Considered Graph API, but can’t provision objectID. Considered PS, but know from Live@EDU that doesn’t scale well • Used DirSync to filter out groups with sensitive memberships. This means we have ~60k groups not provisioned in AAD.  • Lately, I’ve been rethinking whether sending pwd to AAD is such a bad thing …

17. Common Pitfalls • Accepted domains--DirSync drops any UPN, mail or proxyAddresses value that isn't an accepted domain -> Big AD cleanup mini-project • Notification emails only to initial global admin • Number of object sync limit • SQL vs. WID for ADFS • Full SQL vs. SQL Express for DirSync • Tenant user size limit for SO • User retraining: enter the UPN in username • ADFS certificate expiration

18. Advanced Pitfalls • Licensing (slightly outside O365 Identity, but you do need to assign users O365 licenses) • Azure MFA for O365—who? And when? • HA for ADFS (load balancer) • ADFS Claims Transformation Language • DirSync error troubleshooting & navigating Azure AD support • AAD Premium & Enterprise Mobile Suite • Myapps.Microsoft.com, SaaS password vaulting, legal implications …

19. The End Brian Arkills barkills@uw.edu @barkills http://blogs.uw.edu/barkills http://www.netid.washington.edu Author of LDAP Directories Explained